181619 matches found
CVE-2026-110736
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...
DEBIAN-CVE-2026-110736
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...
DEBIAN-CVE-2026-110716
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...
CVE-2026-110661
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFIreadnodeheader that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFIstridxc to scan past disknodedata,...
CVE-2026-110712
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...
CVE-2026-110715
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and...
CVE-2026-110713
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...
CVE-2026-110716
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...
DEBIAN-CVE-2026-110712
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...
DEBIAN-CVE-2026-110714
libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...
CVE-2026-110714
libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...
CVE-2026-110655
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses...
CVE-2026-110656
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP...
CVE-2026-110660
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221lib.c, whose bit reader refills without checking the datau32 array end. Attackers can supply crafted .s14 or .sss files that drive decodevectorquantizedmltindices past the stack buffer...
CVE-2026-110658
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...
CVE-2026-110736
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...
CVE-2026-110736
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...
CVE-2026-110736
Godot Engine versions through 4.7.2 are vulnerable to an out-of-bounds read within the optimized translation loader located at core/string/optimized_translation.cpp in the OptimizedTranslation::get_message function. The root cause is a lack of bounds validation when using offsets from a hash tabl...
EUVD-2026-101289
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...
CVE-2026-110736
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...